Application deployment error codes in Configuration Manager: 0x87D codes and exit codes

A Configuration Manager application that fails in Software Center leaves a hex code, and AppEnforce.log adds the installer's exit code. This quick reference lists 47 codes you meet when deploying apps: Microsoft's meaning, the usual cause and the first check, plus how the Return Codes tab turns an exit code into success, a restart or a retry.

How to read these codes#

You see the code in Software Center, in the console under Monitoring › Deployments (select the deployment, then View Status and the Error tab), and in the Microsoft Intune admin center for tenant-attached devices. The client logs in C:\Windows\CCM\Logs say which stage failed (walkthrough: AppDiscovery, AppEnforce and CAS logs).

• 0x87D0xxxx and 0x87D1xxxx: Configuration Manager client codes.
• Plain decimals such as 1603 or 3010: the installer's exit code, compared with the deployment type's return codes.
• 0x8000…, 0x8004… and 0xC000…: Windows and COM codes; 0x80041…: WMI; 0x0024… and 0x8024…: Windows Update Agent, for an .msu deployed as an application.

Reports and SQL views store codes as signed decimals. Convert both ways in PowerShell:

'0x{0:X8}' -f -2016410844      # 0x87D00324
[int]0x87D00607                # -2016410105

Configuration Manager client codes#

Evaluation, policy and detection#

Enforcement and run time#

Content download#

Installer exit codes and return codes#

When the installer ends, AppEnforce.log looks up its exit code in the deployment type's Return Codes tab. Each code has a type:

• Success (no reboot) and Failure (no reboot).
• Soft Reboot: installed and requests a restart; other installs can run first. Hard Reboot: installed, but nothing else installs until the device restarts.
• Fast Retry: another installation is running; the client retries every two hours, up to 10 times.

Windows Installer deployment types get 0 and 1707 (Success), 3010, 1641 and 1618 by default; Script Installer types get the same without 1707. Any other code is a failure:

Looking for exit code 1603 in exit codes table...
Unmatched exit code (1603) is considered an execution failure.

If a vendor documents another code as success (some return 1), add it as Success (no reboot); values from -2147483648 to 2147483647 are allowed.

Windows, WMI and Windows Update codes#

How to verify a fix#

Editing a deployment type creates a new revision. On a test device, run Machine Policy Retrieval & Evaluation Cycle, then Application Deployment Evaluation Cycle. Good looks like this:

• AppEnforce.log shows Matched exit code 0 to a Success entry in exit codes table., and the detection that follows finds the app.
• Software Center shows Installed; after Run Summarization, the device moves to Success in the deployment status.
• WMI on the device agrees:

Get-CimInstance -Namespace root\ccm\ClientSDK -ClassName CCM_Application |
    Where-Object Name -like 'Contoso*' | Select-Object Name, InstallState, ErrorCode
# InstallState = Installed, ErrorCode = 0

References#

• Application installation error codes reference (Microsoft Learn): Configuration Manager, MSI, Windows, WMI and Windows Update Agent codes
• Create applications in Configuration Manager (Microsoft Learn): return code types and defaults, Maximum allowed run time
• MsiExec.exe and InstMsi.exe error messages (Microsoft Learn): Windows Installer exit codes